dillard
3afe3b7698
Security hardening: CSRF, rate limiting, session/password policy, audit log
...
Fixes critical pre-existing issues found during review: bulk_action.php had no
auth check at all (unauthenticated download/delete of any qrcode) and built a
table name from unwhitelisted user input (SQL injection); the QR generator
classes wrote files from unvalidated filename/format, allowing path traversal
and arbitrary file writes. Also pins chillerlan/php-qrcode to 5.0.5 since
master now requires PHP 8.4, breaking the PHP 8.3 build.
- CSRF tokens on all POST forms and the bulk_action.php JSON endpoint
- Login rate limiting (5 attempts / 15 min) via new login_attempts table
- Hardened sessions: httponly/samesite cookies, 30 min idle timeout,
session regeneration on login
- Forced password change for the default superadmin/superadmin account
- Server-side validation in Users/DynamicQrcode/Qrcode classes
- Audit log table for auth, user, and qrcode actions
- Checked-in db schema (db/init.sql, migrations/) instead of relying on an
opaque prebuilt db image
- Production docker-compose with Nginx + php-fpm instead of the PHP dev server
2026-07-08 15:00:33 +02:00
8db3158239
Remove unnecessary extra information from documentation
2025-09-02 21:56:03 +02:00
b3b799819e
Delete support section from index.html
2025-09-02 21:53:41 +02:00
f89b39bde3
Remove donation button from README
2025-09-02 21:52:03 +02:00
acb154502b
Merge pull request #144 from CLAlberto/master
...
fix(read.php): replace deprecated FILTER_SANITIZE_STRING for PHP 8.3 …
2025-05-08 08:56:07 +02:00
f24a7086ab
fix(read.php): replace deprecated FILTER_SANITIZE_STRING for PHP 8.3 compatibility
...
### Problem
The usage of `FILTER_SANITIZE_STRING` in `read.php` causes a deprecation warning in PHP 8.1 and breaks functionality entirely in PHP 8.3, as the constant was removed.
### Solution
This commit replaces:
```php
filter_input(INPUT_GET, 'id', FILTER_SANITIZE_STRING);
with a safer and future-proof alternative:
$id = filter_input(INPUT_GET, 'id', FILTER_UNSAFE_RAW);
$id = trim(strip_tags($id));
> _Thanks for maintaining this project! Happy to contribute._ 😊
2025-05-06 16:16:22 +02:00
2f0c879158
Merge pull request #143 from angelosleebos/patch-1
...
Make environment variables compatible for other platforms
2025-04-14 12:19:34 +02:00
2ce6a03921
Merge pull request #142 from rafinou62/patch-1
...
Update read.php prevent SQL Injection & XSS attacks
2025-04-14 12:18:32 +02:00
40ec07fbb1
Make environment variables compatible for other platforms
...
Make environment variables compatible for other platforms
2025-04-07 01:11:17 +02:00
6cfbc4a759
Update read.php prevent SQL Injection & XSS attacks
2025-03-26 17:04:33 +01:00
3ee79bfab7
edit demo url
2025-03-22 15:51:02 +01:00
a2fdf79491
config rollback
2025-03-20 23:38:55 +01:00
236d7342d3
Merge remote-tracking branch 'origin/master'
2025-03-19 23:40:50 +01:00
1f3110b26e
bug fix Class Qrcode not found
2025-03-19 23:40:36 +01:00
8b24fd839d
Merge pull request #136 from MickGe/patch-1
...
add cookies secure flags
2025-02-09 16:16:53 +01:00
011e91e3d0
add cookies secure flags
2025-02-07 11:35:24 +01:00
737ceca97b
updated readme and docs
2025-01-21 22:41:14 +01:00
b4b42ddb29
updated readme
2025-01-12 23:50:15 +01:00
3ca4163715
Local setup eliminated and documentation updated
2025-01-12 23:48:49 +01:00
c5f1b0d74f
Merge remote-tracking branch 'origin/master'
2025-01-12 19:48:31 +01:00
d825f597b8
Merge pull request #130 from Shineson1001/feature/129-QRCodeGeneratorSwitch
...
🐛 Global switch for the QR code generator (#129 )
2025-01-02 12:04:55 +01:00
850f5e5c52
🐛 Global switch for the QR code generator ( #129 )
2024-12-31 20:48:56 +01:00
c46dae55ce
Revert "Revert "Instead using external API (api.qrserver.com) .. use chillerlan/php-qrcode""
...
This reverts commit 4d33cf5379
2024-12-23 18:52:11 +01:00
4d33cf5379
Revert "Instead using external API (api.qrserver.com) .. use chillerlan/php-qrcode"
...
This reverts commit 6d42677732
2024-12-23 18:49:05 +01:00
a1bd583ad3
Merge pull request #128 from Shineson1001/feature/116-EventIncorrectTimeZone
...
🐛 Event: Incorrect Time Zone
2024-12-20 20:02:32 +01:00
597afbb1fe
🐛 Event: Incorrect Time Zone
...
- Add "Time zone" input field.
- 24-Hour time format.
- Set Min-Year and Max-Year dynamically
2024-12-19 22:34:42 +01:00
5028541bfd
Merge pull request #127 from Shineson1001/feature/88-SelfHostedQRCodeGenerator
...
Instead using external API (api.qrserver.com) .. use chillerlan/php-qrcode
2024-12-15 16:35:29 +01:00
6d42677732
Instead using external API (api.qrserver.com) .. use chillerlan/php-qrcode
2024-12-15 14:36:39 +01:00
1499f06c71
Merge pull request #126 from Shineson1001/feature/2FA-QRCodes
...
Add 2FA QR Code
2024-12-14 09:17:50 +01:00
058277c0fc
Add 2FA QR Code
...
Save your 2FA secrets to QR-Code.
2024-12-13 23:42:57 +01:00
a426d45be1
available plugins
2024-10-20 16:32:58 +02:00
3f7ac0bce1
Update README.md
2024-10-20 11:07:12 +02:00
9548a6d73a
bug fix in helpers.php
2024-04-21 12:55:03 +02:00
2715f2106c
edit readme
2024-04-21 12:38:35 +02:00
e43e8f774e
bug fix
2024-04-18 20:54:04 +02:00
acebfdd708
fix in bulk action
2024-04-18 20:44:22 +02:00
005c67d721
readme
2024-04-18 20:35:04 +02:00
9f2d14abf8
bug fix in read.php, bump version in footer, NEW: bulk delete
2024-04-18 20:33:20 +02:00
eba0ebbba7
bug fix database prefix in Qrcode class
2024-03-11 15:43:16 +01:00
068ddebd35
bug fix bulk download
2024-03-04 14:36:18 +01:00
d0d3daf7db
Merge pull request #94 from tranmh/xss_static_qrcode
...
Fix Security: Stored Cross Site Scripting for static QR code
2024-03-01 09:58:29 +01:00
92eb66fb35
Fix Security: Stored Cross Site Scripting for static QR code, see https://github.com/giandonatoinverso/PHP-Dynamic-Qr-code/issues/93
2024-03-01 08:03:31 +01:00
b85f98e16d
Merge pull request #92 from tranmh/fix_remove_DATABASE_PREFIX_for_getOne
...
Inconsistency of using DATABASE_PREFIX with getOne()
2024-02-29 00:25:17 +01:00
a7953f05bb
Inconsistency of using DATABASE_PREFIX with getOne()
2024-02-28 16:56:39 +01:00
06ddd19378
Merge pull request #91 from tranmh/mixed_content_blocked
...
fix: mixed content blocked for http and https
2024-02-28 14:16:21 +01:00
2b6c802659
fix mixed content blocked for http and https: Mixed Content: The page at ' https://localhost/qrcode/dynamic_qrcodes.php ' was loaded over HTTPS, but requested an insecure stylesheet ' http://code.ionicframework.com/ionicons/2.0.1/css/ionicons.min.css '. This request has been blocked; the content must be served over HTTPS.
2024-02-28 13:55:44 +01:00
33651fcabb
Merge pull request #90 from tranmh/fix_case_sensitive_filename
...
Fix case sensitive filename
2024-02-27 13:25:17 +01:00
b496e51ace
fix: case sensitive for filename
2024-02-27 13:18:52 +01:00
1217e32856
fix: case sensitive for filename
2024-02-27 13:18:01 +01:00
6646cc9545
increased size of column link - dynamic qrcode
...
increased size of column link - dynamic qrcode
2024-02-14 23:58:00 +01:00
915ea383b7
Update README.md
...
updated php version requirement
2024-01-03 00:43:50 +01:00
93980efdb7
Update README.md
2023-10-30 17:02:13 +01:00
b52a61ca40
bug fix redirect url with docker installation
2023-10-17 23:24:34 +02:00
c9fa6abf06
bug fix
2023-10-17 00:41:15 +02:00
15c84c0863
bug fix and documentation
2023-10-16 22:57:16 +02:00
90a7b2890b
updated documentation
2023-10-16 22:24:15 +02:00
03da2d0432
updated documentation
2023-10-16 20:56:06 +02:00
68a2b9f7f3
Refactoring docker image building, NEW: added docker compose support
...
Signed-off-by: giandonato.inverso@edempg.it <giandonato.inverso@studenti.unimi.it >
2023-10-16 19:49:29 +02:00
5335b6fb7e
readme updated
...
Signed-off-by: giandonato.inverso@edempg.it <giandonato.inverso@studenti.unimi.it >
2023-10-16 13:15:53 +02:00
fadde16882
readme updated
...
Signed-off-by: giandonato.inverso@edempg.it <giandonato.inverso@studenti.unimi.it >
2023-10-16 13:15:07 +02:00
575a6b3caa
refactoring of table database, added script for upgrading to versions >= 2.0, added multi-user support
...
Signed-off-by: giandonato.inverso@edempg.it <giandonato.inverso@studenti.unimi.it >
2023-10-16 13:10:57 +02:00
cdab7df35d
readme updated
...
Signed-off-by: giandonato.inverso@edempg.it <giandonato.inverso@studenti.unimi.it >
2023-10-16 01:43:56 +02:00
9a0a2c7928
eliminazione file superflui, spostamento file read.php all'interno del progetto, aggiunta astrazione classe Qrcode, miglioramento download bulk, refactoring generale
...
Signed-off-by: giandonato.inverso@edempg.it <giandonato.inverso@studenti.unimi.it >
2023-10-16 01:41:27 +02:00
995272fa8d
Bug fix login.php
...
removed .min extension adminlte js file
2023-09-16 14:51:04 +02:00
ef6410253c
paypal donations
2023-09-05 23:31:38 +02:00
f9ad48f65a
Update README.md
2023-09-05 23:29:51 +02:00
4b28c09d49
Merge remote-tracking branch 'origin/master'
2023-08-22 17:15:09 +02:00
d14ec02e4e
doc update
...
Signed-off-by: giandonato.inverso@edempg.it <Zannabianca20>
2023-08-22 17:14:52 +02:00
c87a99a067
Update Dockerfile
2023-01-25 18:51:10 +01:00
eb3c275035
Merge pull request #52 from AyhamAl-Ali/fix/db_prefix
...
🚀 Fix DB Prefix in `read.php`
2023-01-25 18:50:15 +01:00
e448066176
Fix DB Prefix
2023-01-25 20:47:52 +03:00
abd55062f3
Merge pull request #45 from chilluniverse/patch-1
...
DATABASE_HOST
2022-10-14 10:36:59 +02:00
e99e97cae2
DATABASE_HOST
...
In the docker-compose.yml is the Database_Host defined as "mariadb". If Host is not changed in the environment.php to "mariadb" as well the setup will fail
2022-10-14 01:26:06 +02:00
6d1c3ac7c4
new version dockerfile
2022-09-28 16:23:44 +02:00
e2d9aad91f
new version dockerfile
2022-09-28 16:22:18 +02:00
fa709c95db
Merge pull request #37 from 0xRenegade/feature/download-multiple-qr-img-at-once
...
Error Message for no qrcodes selected.
2022-09-24 22:43:16 +02:00
8cb8e36114
Error Message for no qrcodes selected.
2022-09-24 15:40:56 -05:00
c3225c6f3f
Merge pull request #36 from 0xRenegade/feature/download-multiple-qr-img-at-once
...
Feature/download multiple qr img at once
2022-09-24 22:26:36 +02:00
9cf354910b
download multiple qrcodes at once feature
2022-09-24 15:14:20 -05:00
a18657994e
add base_url() function in helpers, works with https and port number
2022-09-24 14:32:04 -05:00
4b5c9a800b
adds in custom.css for, well, custom styles.
2022-09-24 13:09:17 -05:00
a85cee4fda
Merge pull request #35 from 0xRenegade/issue-30/update-docker-yml-for-db-prefix
...
Issue 30/update docker yml for db prefix
2022-09-24 19:44:31 +02:00
327cadaddb
Merge pull request #33 from 0xRenegade/QOL/ignore-env-and-use-example-instead
...
QOL/ignore env and use example instead
2022-09-24 19:44:23 +02:00
4da9be3e3e
update docker-compose.yml for database prefix option
2022-09-24 12:19:40 -05:00
b26c905b2e
update docs for this change
2022-09-24 11:52:34 -05:00
f458094e0d
update main gitignore to add in environment.php
2022-09-24 11:44:02 -05:00
b16f30b5a3
move env to example, so we don't run into merge conflicts constantly
2022-09-24 11:42:17 -05:00
f072f151fd
Merge pull request #1 from giandonatoinverso/master
...
sync master branch with remote
2022-09-24 11:28:55 -05:00
38ddbe43c7
Merge pull request #31 from 0xRenegade/renegade/general-fixes
...
general fixes, fixed database prefix during install
2022-09-24 11:53:34 +02:00
9799509ff6
set static attribute of class rather than non-DRY code
2022-09-24 00:24:03 -05:00
f0d43fd18b
remove error_log debugging
2022-09-24 00:05:50 -05:00
5e531f4e15
updated MysqliDb class functions to handle prefix properly.
2022-09-23 23:44:01 -05:00
a0944afd3c
if this feature is accepted in Pull Request, will need to add this back
2022-09-23 23:02:05 -05:00
9b61284a1e
Merge branch 'renegade/general-fixes' of github.com:0xRenegade/PHP-Dynamic-Qr-code into renegade/general-fixes
2022-09-23 23:01:05 -05:00
70ec7afc90
some queries are manually entered, which aren't picked up by 'prefix' class attribute in database class
2022-09-23 22:59:53 -05:00
1934c78251
Merge branch 'master' into renegade/general-fixes
2022-09-23 21:05:16 -05:00
8f053474e7
added in prefix by default, oops.
2022-09-23 21:00:41 -05:00
b80636049f
Issue #30 : Fixes database_prefix option during install
2022-09-23 20:55:55 -05:00
a8e4cf18ff
Update config.php
2022-09-24 03:24:15 +02:00
418215cd23
Update docker-compose.yml
2022-09-24 03:23:41 +02:00
8bbb4354c0
Update environment.php
2022-09-24 03:23:20 +02:00
2057df1924
missing scroll bar on documentation page sidebar
2022-09-23 20:09:22 -05:00
b457823654
Update add_dynamic_form.php
...
added support for http url
2022-09-10 11:50:19 +02:00
02754fba37
Update MysqliDb.php
...
fix deprecated implode()
2022-09-05 20:40:26 +02:00
25add5b7fd
Merge pull request #25 from nirpt/master
...
docker build now supports app release version code.
2022-08-29 14:09:34 +02:00
2aa867aa2a
Docker build with app version added.
2022-08-29 12:32:20 +02:00
9cbf68a99e
Merge remote-tracking branch 'origin/master'
...
# Conflicts:
# docker/README.md
2022-08-28 13:22:12 +02:00
dfaee77d86
Update README.md
2022-08-28 12:33:14 +02:00
59c6dc9233
doc update
...
Signed-off-by: giandonato.inverso@edempg.it <Zannabianca20>
2022-08-28 12:04:48 +02:00
c3e04a4357
new installation process via script, elimination of data entry form for installation
...
Signed-off-by: giandonato.inverso@edempg.it <Zannabianca20>
2022-08-28 11:57:31 +02:00
97da7f0d4f
Minor refactor and cleanup
2022-08-28 11:29:20 +02:00
4dd7f9ab25
configuration file modification, docker environment variable support
2022-08-28 11:24:32 +02:00
3000271d95
Merge pull request #23 from nirpt/master
...
docker support added
2022-08-28 10:47:05 +02:00
1194259e6e
docker support added
2022-08-28 10:24:07 +02:00
5f1534f0be
Update README.md
2022-06-17 11:49:06 +02:00
c76c1164fc
Update README.md
2022-06-17 11:48:44 +02:00
c8b3bba9f0
Merge pull request #16 from neoteknic/patch-1
...
Fix php 8.1 warning in form field
2022-02-22 16:55:19 +01:00
10091ac8e4
Update filters.php
...
Fix php 8.1 warning in form field
2022-02-22 16:22:13 +01:00
a6bf0d6ca9
Add files via upload
2020-09-08 18:43:51 +02:00
44e8465129
Add files via upload
2020-09-08 18:42:29 +02:00
cd00141252
Add files via upload
2020-09-08 18:41:51 +02:00
0ca8bd7cb2
Add files via upload
2020-09-08 18:30:32 +02:00
554a27762d
Add files via upload
2020-09-08 18:28:26 +02:00
36c52ba003
Add files via upload
2020-09-08 18:22:57 +02:00
773d4960fd
Add files via upload
2020-09-08 18:20:38 +02:00
7757bcf76b
Add files via upload
2020-09-08 18:17:08 +02:00
76883de681
Add files via upload
2020-09-08 18:15:54 +02:00
8d45a02149
Add files via upload
2020-09-08 18:13:36 +02:00
d3e11399f7
Add files via upload
2020-09-08 18:11:37 +02:00
86f32b6327
Add files via upload
2020-09-08 18:09:19 +02:00
97df13f3f0
Add files via upload
2020-09-08 18:06:28 +02:00
4ac9cd811a
Add files via upload
2020-09-08 17:59:49 +02:00
1968201a48
Add files via upload
2020-09-08 17:59:21 +02:00
b39c88fc12
Update README.md
2020-09-08 17:31:01 +02:00
9118d4f33c
Update README.md
2020-09-08 17:29:26 +02:00
f8bc49c164
Update README.md
2020-09-08 17:26:41 +02:00
9db2388d51
Update README.md
2020-09-08 17:25:38 +02:00
03c9c2d720
Update README.md
2020-09-08 17:24:07 +02:00
3bb2545521
Update README.md
2020-09-08 17:23:38 +02:00
283df4b81c
Update README.md
2020-09-08 17:23:17 +02:00
e64ca74003
Update README.md
2020-09-08 17:23:02 +02:00
0c2988791f
Update README.md
2020-09-08 17:22:41 +02:00
e123385dac
Update README.md
2020-09-08 17:22:25 +02:00
1c819e6626
Update README.md
2020-09-08 17:21:33 +02:00
8af83452ba
Update README.md
2020-09-08 17:21:07 +02:00
527eb7b3ba
Update README.md
2020-09-08 17:20:39 +02:00
fe4c63e3a6
Update README.md
2020-09-08 17:20:20 +02:00
601be05d5c
Update README.md
2020-09-08 17:20:05 +02:00
f4f061d857
Update README.md
2020-09-08 17:18:41 +02:00
f1eb8545b4
Update README.md
2020-09-08 17:17:36 +02:00
7e3cef7544
Update README.md
2020-09-08 17:14:57 +02:00
5530f62195
Update README.md
2020-09-08 17:13:33 +02:00
df3211d583
Update README.md
2020-09-08 17:13:06 +02:00
117b2b21a2
Update README.md
2020-09-08 17:12:50 +02:00
5430504fa0
Update README.md
2020-09-08 17:12:34 +02:00
65c279b65d
Update README.md
2020-09-08 17:12:01 +02:00
ceda04f97e
Update README.md
2020-09-08 17:11:45 +02:00
76cad846f9
Update README.md
2020-09-08 17:11:27 +02:00
f0d187f8b7
Update README.md
2020-09-08 17:10:01 +02:00
fefac0fa9f
Update README.md
2020-09-08 17:09:36 +02:00
6f920aec63
Update README.md
2020-09-08 17:09:15 +02:00
ab7a82edbf
Update README.md
2020-09-08 17:08:42 +02:00
7e867ddf9d
Update README.md
2020-09-08 17:07:06 +02:00
255201169f
Update README.md
2020-09-08 17:06:25 +02:00
ca0108c247
Update README.md
2020-09-08 17:05:43 +02:00
23864047ce
Initial commit
2020-09-08 16:56:05 +02:00
dillard
Giandonato Inverso